@faable/faable 4.18.5 → 4.20.0

package/dist/api/FaableApi.js

@@ -290,6 +290,11 @@ class FaableApi {
             headers: projectHeader(team)
         }));
     }
+    // Native GitLab (api §393): link a gitlab.com project; the api creates the
+    // push webhook with the caller's GitLab token.
+    async linkGitlab(app_id, params, team) {
+        return data(this.client.post(`/app/${app_id}/link-gitlab`, params, { headers: projectHeader(team) }));
+    }
     // Organizations/accounts where the Faable GitHub App is installed.
     async listGithubInstallations() {
         return data(this.client.get(`/github/installations`)).then(res => res.installations);
@@ -379,6 +384,13 @@ class FaableApi {
     async setDeployBranch(app_id, github_branch) {
         return data(this.client.post(`/app/${app_id}/deploy-branch`, { github_branch }));
     }
+    // The GitLab project (numeric id) whose CI may deploy the app keyless; null
+    // revokes it.
+    async setCiTrust(app_id, gitlab_project_id) {
+        return data(this.client.post(`/app/${app_id}/ci-trust`, {
+            gitlab_project_id
+        }));
+    }
     // null clears the platform override (faable.json's rootDir applies again).
     async setRootDir(app_id, root_dir) {
         return data(this.client.post(`/app/${app_id}/root-dir`, { root_dir }));

package/dist/api/context.js

@@ -38,6 +38,21 @@ const context = async (targetAppId) => {
             console.error("Error fetching token, configure 'permissions: id-token: write'");
         }
     }
+    else if (process.env.GITLAB_CI === "true" && process.env.FAABLE_ID_TOKEN) {
+        // GitLab CI: the job declares
+        //   id_tokens: { FAABLE_ID_TOKEN: { aud: https://faable.com } }
+        // and the app must trust its project (`deploy apps set --gitlab-project`).
+        // Without FAABLE_ID_TOKEN a GitLab job falls through to an API key or
+        // the local credentials, as before.
+        api = FaableApi.create({
+            authStrategy: oidc_strategy,
+            auth: {
+                idToken: process.env.FAABLE_ID_TOKEN,
+                appId: targetAppId,
+                provider: "gitlab",
+            },
+        });
+    }
     else {
         const store = new CredentialsStore();
         // Auto-refreshes an expired access token via the stored refresh_token.

package/dist/api/strategies/oidc.strategy.js

@@ -1,6 +1,31 @@
 import axios from 'axios';
 import { create_base_client } from '../base_client.js';
 
+// GitLab has no linked repository to infer the app from: the job names it
+// with `faable deploy --app`, and the api checks the app trusts the token's
+// project (`faable deploy apps set --gitlab-project <id>`).
+const exchangeGitlabOidcToken = async (gl_token, target_app_id) => {
+    if (!target_app_id) {
+        throw new Error("Keyless deploys from GitLab CI need the app: run `faable deploy --app <app_id>`.");
+    }
+    const client = create_base_client();
+    try {
+        const res = await client.post("/auth/gitlab-oidc", {
+            token: gl_token,
+            app_id: target_app_id,
+        });
+        const { access_token, app_id } = res.data;
+        return { access_token, app_id };
+    }
+    catch (err) {
+        if (axios.isAxiosError(err)) {
+            const status = err.response?.status;
+            const serverMessage = err.response?.data?.message;
+            throw new Error(`Faable OIDC token exchange failed (${status ?? "network error"})${serverMessage ? `: ${serverMessage}` : ""}`, { cause: err });
+        }
+        throw err;
+    }
+};
 const exchangeGithubOidcToken = async (gh_token, target_app_id) => {
     const client = create_base_client();
     try {
@@ -35,14 +60,16 @@ const exchangeGithubOidcToken = async (gh_token, target_app_id) => {
     }
 };
 const oidc_strategy = (config) => {
-    const { idToken, appId } = config;
+    const { idToken, appId, provider = "github" } = config;
     if (!idToken) {
         throw new Error("Missing idToken.");
     }
     let token_ex;
     const ensure = async () => {
         if (!token_ex)
-            token_ex = await exchangeGithubOidcToken(idToken, appId);
+            token_ex = await (provider === "gitlab"
+                ? exchangeGitlabOidcToken(idToken, appId)
+                : exchangeGithubOidcToken(idToken, appId));
         return token_ex;
     };
     return {

package/dist/commands/deploy/apps/set.js

@@ -31,16 +31,25 @@ const apps_set = {
         choices: MODES,
         description: 'push: every push deploys · ci: once CI tags a release · workflow: your own GitHub workflow runs faable deploy'
     })
-        .check(({ branch, rootDir, mode }) => {
+        .option('gitlab-project', {
+        type: 'string',
+        description: 'GitLab project ID (the number on its page) whose CI may deploy this app without an API key ("" revokes it)'
+    })
+        .check(({ branch, rootDir, mode, gitlabProject }) => {
         if (branch === undefined &&
             rootDir === undefined &&
-            mode === undefined) {
-            throw new Error('Nothing to change: pass --branch, --root-dir or --mode.');
+            mode === undefined &&
+            gitlabProject === undefined) {
+            throw new Error('Nothing to change: pass --branch, --root-dir, --mode or --gitlab-project.');
+        }
+        if (gitlabProject && !/^[0-9]+$/.test(String(gitlabProject))) {
+            throw new Error('--gitlab-project takes the numeric Project ID shown on the GitLab project page, not its path.');
         }
         return true;
     })
         .example('$0 deploy apps set --branch release', 'Deploy from "release"')
         .example('$0 deploy apps set --root-dir apps/web', 'A monorepo app')
+        .example('$0 deploy apps set --gitlab-project 12345678', 'Let that GitLab project deploy keyless')
         .showHelpOnFail(false),
     handler: async (args) => {
         const ctx = await requireApi();
@@ -60,6 +69,12 @@ const apps_set = {
             await ctx.api.setDeployMode(app_id, args.mode);
             log.info(`⚙️ Deploy mode: ${args.mode}`);
         }
+        if (args.gitlabProject !== undefined) {
+            await ctx.api.setCiTrust(app_id, String(args.gitlabProject) || null);
+            log.info(args.gitlabProject
+                ? `🦊 GitLab project ${args.gitlabProject} can deploy this app without an API key`
+                : '🦊 GitLab keyless deploys revoked');
+        }
         const app = await ctx.api.getApp(app_id);
         if (args.json)
             return print_json(app);

package/dist/commands/link/index.js

@@ -28,6 +28,10 @@ const link = {
             alias: "r",
             type: "string",
             description: "GitHub repository, owner/repo or its URL (defaults to the origin remote of --workdir)",
+        })
+            .option("gitlab", {
+            type: "string",
+            description: "Link a gitlab.com project instead: its Project ID (the number on its page). Needs --app and GitLab connected in the dashboard",
         })
             .option("branch", {
             alias: "b",
@@ -40,9 +44,12 @@ const link = {
             description: "Print the link as JSON: app, repository, branch and how it deploys",
         })
             .example("$0 deploy link --app web --repo acme/web", "Link acme/web to the app web: from now on a push deploys it")
+            .example("$0 deploy link --app web --gitlab 12345678", "Link that gitlab.com project to the app web: pushes deploy it")
             .showHelpOnFail(false);
     },
     handler: async (args) => {
+        if (args.gitlab !== undefined)
+            return link_gitlab(args);
         if (args.app || args.json || is_non_interactive()) {
             return link_to_app(args);
         }
@@ -147,6 +154,39 @@ const link = {
 // repository to an existing app at all (arch/deploy/cli-mcp-fallos-2026-10-16-plan.md,
 // F4; backlog §366). Driven by a program, the repository is spelled out too:
 // the origin remote of whatever directory the process runs in is a guess.
+const link_gitlab = async (args) => {
+    if (!args.app) {
+        throw new CliError("app_required", "Say which app to link: --app <id|name>.");
+    }
+    const project_id = String(args.gitlab ?? "");
+    if (!/^[0-9]+$/.test(project_id)) {
+        throw new CliError("usage", "--gitlab takes the numeric Project ID shown on the GitLab project page, not its path.");
+    }
+    const { api } = await requireApi();
+    const app = await api.getApp(await resolve_app_ref(api, args.app));
+    let linked;
+    try {
+        linked = await api.linkGitlab(app.id, { project_id, ...(args.branch ? { branch: args.branch } : {}) }, app.team);
+    }
+    catch (err) {
+        const e = err;
+        const failed = new CliError("usage", `Could not link GitLab project ${project_id} to ${app.name}: ${e.message}`, { status: e.status, action: e.action, cause: err });
+        // gitlab_identity_missing / gitlab_token_invalid / gitlab_project_not_accessible
+        if (e.code)
+            failed.code = e.code;
+        throw failed;
+    }
+    const result = {
+        app_id: app.id,
+        app_name: app.name,
+        gitlab_project: linked?.gitlab_project_path ?? project_id,
+        branch: linked?.gitlab_branch,
+    };
+    if (args.json)
+        return print_json(result);
+    log.info(`Linked ${result.gitlab_project} (GitLab) to ${app.name} (${app.id}).`);
+    log.info(`Push to deploy is on: the next push to "${result.branch ?? "the default branch"}" deploys.`);
+};
 const link_to_app = async (args) => {
     if (!args.app) {
         throw new CliError("app_required", "Say which app to link: --app <id|name>. Without a terminal there is no list to pick from.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "4.18.5",
+  "version": "4.20.0",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",